Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

No Check on Token Contract Validity in deposit and withdraw on Treasury.sol

merryjoy881

Summary

There is no validation to ensure that the provided token contract is valid. A malicious contract could be passed as the token parameter, potentially leading to unintended behavior or loss of funds.

Vulnerability Details

IERC20(token).transferFrom(msg.sender, address(this), amount);
IERC20(token).transfer(recipient, amount);

Impact

If a malicious contract is used, it could manipulate token transfers or have other vulnerabilities that compromise the treasury’s integrity.

Tools Used

Recommendations

Add checks to ensure the token is a valid ERC20 token contract. This can be done by checking that the token implements the IERC20 interface correctly, or by adding a whitelist of valid token contracts. Consider adding an interface check or whitelisting valid token contracts before performing transfers:

require(IERC20(token).totalSupply() > 0, "Invalid token contract");
Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Treasury::deposit increments _totalValue regardless of the token, be it malicious, different decimals, FoT etc.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.